The simple answer is that you don't. A bad actor with a success rate of >0% is successful. A website with a protection rate of <100% is a failure. The unbalance

The simple answer is that you don't. A bad actor with a success rate of >0% is successful. A website with a protection rate of <100% is a failure. The unbalanced economic underpinnings (cheap to attack, expensive to protect) along with the necessity for perfection in protection makes it virtually assured that _every_ system, in time, will be compromised. Certainly there are levels of loss - single user information, just usernames, entire user list with banking data, etc. There are ways to mitigate the amount lost, but generally the more secure the system is overall, the more hoops legitimate users must go through to use the system. Then it becomes an economic trade off between security strength and user loss due to onerous authentication requirements. Our society has, for now, chosen a model that is low barrier to entry, reasonably low cost, with some risk.